PostNuke Modules Factory Subjects Module Remote SQL Injection Vulnerability

vendor:

Modules Factory Subjects module

by:

Unknown

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Modules Factory Subjects module

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

PostNuke Modules Factory Subjects Module Remote SQL Injection Vulnerability

The PostNuke Modules Factory Subjects module is affected by a remote SQL injection vulnerability. This issue allows an attacker to manipulate SQL queries and potentially disclose sensitive information or corrupt data.

Mitigation:

The vendor has not provided a patch or mitigation for this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/11148/info

Reportedly the PostNuke Modules Factory Subjects module is affected by a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI parameters.

An attacker might exploit this issue to manipulate SQL queries carried out against the database; it may be possible to disclose sensitive information such as the administrator password hash, as well as corrupt arbitrary data. SQL injection issues may also facilitate attacks against latent vulnerabilities in the underlying database.

http://www.example.com/index.php?module=subjects&func=listpages&subid=[SQL]
http://www.example.com/index.php?module=subjects&func=viewpage&pageid=[SQL]
http://www.example.com/index.php?module=subjects&func=listcat&catid=[SQL]